Serguey Asael Shinder: Payara's October release patches a GlassFish RCE and adds two delete commands

15 October 2026, 07:40 · by Serguey Asael Shinder / Serguey Shinder

The October 2026 Payara release, described in a post on foojay.io on 14 October, covers two tracks: the open-source Payara Community 7.2026.10 and the commercial Azul Payara Server and Micro 7.5.0, 6.43.0, 5.92.0 and 4.1.2.191.60.

Security first on the commercial lines. All four Azul Payara branches ship three security fixes: CVE-2026-2587 and CVE-2026-2586, described as a remote code execution vulnerability in Eclipse GlassFish, and a cross-site scripting flaw in the Admin Console that the post says allows full control. The fixes go to every supported branch, not only the newest one. The release notes flag no breaking changes this cycle.

Serguey Asael Shinder: Payara's October release patches a GlassFish RCE and adds two delete commands — Payara's October release patches a GlassFish RCE and adds two delete commands — Serguey Asael Shinder

Community 7.2026.10 is about operations. The post lists:

SSH nodes no longer need elevated permissions. The account Payara uses on a remote node needs only the access the work itself requires.
Two new commands, delete-jvm-option and delete-system-properties, so scripted setups can undo configuration from the command line.
Fixes from real deployments: concurrent deployments failing because SaxParserHandlerBundled was a stateful singleton; applications using the MicroProfile REST Client not deploying after a domain restart; the start-domain admin-password recovery prompt breaking because auth-realm-name was dropped when domain.xml was rewritten; and the Request Tracing Service still generating random UUIDs when turned off.
The JNDI context now throws NameNotFoundException when a name cannot be found.

Three of the Community changes came from outside contributors — the REST Client deployment fix, a leak-prevention change for the JAX-RS client in WAR libraries, and the JNDI change.

Baselines. The 7 line stays on Jakarta EE 11 and MicroProfile 7.1. Azul Payara 7.5.0 also moves to EclipseLink 5.0.1, while 6.43.0 and 5.92.0 remove DCOM support.

The post mixes release notes with product positioning. The CVE identifiers and the fix list are the parts to check against your own version before planning an upgrade; the post says every Community fix links to its pull request in the release notes.